CVE-2026-59681

CVE-2026-59681 is an OS command injection (CWE-78) in yast2-auth-client, the SUSE YaST module used to join SUSE/openSUSE machines to Active Directory domains. The Auth::AuthConf helper in src/lib/auth/authconf.rb assembles Samba "net ads join", "net ads lookup -S" and "net ads testjoin" invocations by interpolating configuration values into a single command string passed to Open3.popen2/Open3.capture2, which Ruby executes through /bin/sh. Because the Organizational Unit (ou), dnshostname, AD user name and AD domain name values are neither validated nor shell-quoted, an attacker who controls those AD configuration values (for example via a rogue or compromised domain controller, or attacker-supplied join settings) can inject arbitrary commands that run with root privileges on the configured host when the module performs the join/lookup/testjoin operations. Affected are SUSE/openSUSE hosts on which yast2-auth-client is used to configure AD authentication; the CVSS 4.0 score is 8.7 (High) with network attack vector and required user interaction. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS currently estimates a 1.1% probability of exploitation within 30 days (65th percentile).

What to do: Install the patched yast2-auth-client package from SUSE/openSUSE security repositories as soon as SUSE publishes a fix (no fixed version is given in the available data). Until then, only join hosts to trusted AD domains, treat domain controller-provided values (dnshostname, OU, user and domain names) as untrusted input, and review hosts recently domain-joined via YaST for unexpected root-level changes or unusual net ads activity.